@open-everywhere/core 0.1.0

package/agent/tools/rotate_webhook.ts

@@ -0,0 +1,185 @@
+// rotate_webhook re-mints an existing webhook's signing secret and hands the new one over, once. This is the ONLY recovery path, and that is deliberate: a re-reveal would make every hook row a standing disclosure oracle, and in the audit log it is INDISTINGUISHABLE from an attacker-driven exfiltration of a live production secret. Rotation costs the human the identical work while bounding disclosure to material minted FOR that disclosure, so "I lost the secret" and "the secret leaked" get the same answer — the one that is safe when you cannot tell which you are looking at.
+// Gated: rotation widens nothing, but it DISCLOSES, so a human still reads a card. 🔴 The reveal is bound to the ASKER, not to whoever clicks (OPE-327 — Tommy's ruling, 2026-08-08: approval is fungible across the admins of a room, custody of a live signing key is not). The approver sees the decision; only the person who asked receives the material. A tainted turn is floored at a human decision, which an unattended run denies. The overlap that keeps the superseded secret verifying is HOST-CLAMPED with no parameter for the model, because "how long does the old key stay live" is a security window, not a preference.
+
+import { defineTool } from "eve/tools";
+import { never } from "eve/tools/approval";
+import { z } from "zod";
+import { resolvePartition } from "../memory/partition.js";
+import { proposalScopeKey } from "../channels/propose-scope.js";
+import { actingPrincipalIdOf, resolveMode, unattendedOf } from "../access/request.js";
+import { bindFrom } from "../identity/binding.js";
+import { requestApproval, postedToSurfaceKey, autoApprovedNote } from "../approvals/flow.js";
+import { proposerTail } from "../approvals/card-venue.js";
+import { approvalPostDeps } from "./set_spend_limit.js";
+import { requireSessionContinuation } from "../spend/checkpoint.js";
+import { revealPageAvailable } from "../webhooks/reveal-page.js";
+
+/**
+ * Can a secret be handed to ONE person privately on this platform? Slack only, honestly: its ephemeral post addresses one member in-channel, while Discord's equivalent needs an interaction token that exists only inside the provider's own click handler and is unreachable from a core action's execute.
+ * So Discord is REFUSED here rather than claimed and silently degraded to a channel post that every member — including, on a shared surface, people outside the org — could read.
+ *
+ * 🔴 THIS PREDICATE IS STRICTLY NARROWER THAN `hasApprovalCardPath`, and the gap is load-bearing: it is what makes this tool's card-less refusal unredirectable, and therefore what carves it out of the OPE-325/326 venue sweep. `webhook-provisioning-test.ts` § PRIVATE DELIVERY predicate pins the implication over every known platform. A second private-delivery arm breaks it, and at that moment the card-less redirect becomes reachable and has to be designed rather than assumed away.
+ */
+export function hasPrivateDeliveryPath(platform: string): boolean {
+  return platform === "slack";
+}
+import { getConfig } from "../access/config.js";
+import { configHookPosture, findWebhook } from "../webhooks/config.js";
+
+export default defineTool({
+  description:
+    "Issue a signing secret for a webhook that exists here, and send it privately as a one-time link. Use when someone lost the secret, thinks it leaked, is rotating on a schedule, or when a newly declared webhook needs its FIRST secret so it can start authenticating — that last case needs no redeploy. There is deliberately no way to re-show an existing secret; issuing a new one IS the way to recover from a lost one. A card is posted for a human to approve first, and it says exactly what stops working and when.",
+  inputSchema: z.object({
+    source: z.string().min(1).describe("Which webhook — the name it is listed under (see list_webhooks)."),
+  }),
+  outputSchema: z.object({
+    rotated: z.boolean(),
+    pending: z.boolean(),
+    pendingId: z.string().optional(),
+    source: z.string(),
+    message: z.string(),
+    autoApproved: z.boolean().optional().describe("The approver chain lowered this verb: no card was posted and it has ALREADY run."),
+  }),
+  approval: never(),
+  async execute(input, ctx) {
+    await requireSessionContinuation(ctx, "rotate_webhook");
+
+    // NO TAINT PRE-REFUSAL HERE (OPE-438) — see declare_webhook.ts's note at the same seam. The
+    // approver chain is the single gate: `taint: "gate"` floors a tainted turn at `ask`, and the
+    // `unattended` arrow denies that ask when there is nobody to click it.
+    const mode = resolveMode(ctx);
+    if (mode === "mpim") throw new Error("Group DMs are execution-only — rotate from a channel or a DM instead.");
+
+    const binding = bindFrom(ctx);
+
+    // principal-gate: presence — this tool's entire product is HANDING A SECRET TO SOMEBODY. The
+    // refusal below already refuses when there is no private channel to deliver one over; a fire is
+    // the same defect one step earlier — there is no recipient at all, only a person whose name the
+    // rotation would be recorded under while a one-time link goes somewhere they never asked for.
+    //
+    // 🔴 THE ACTING principal (identity/binding.ts actingPrincipalId), never the resolvable one
+    // (OPE-273). `principalIdOf` was answered by a fire's ATTESTED creator, so the gate was
+    // unreachable on a fire — and rotating invalidates the live secret, so a fire reaching it is
+    // both a credential mint and an outage for every sender using the old one.
+    //
+    // ASKED BEFORE the delivery-path and registry checks below for declare_webhook's reason: whether
+    // a human is here is a property of the turn, not of the deployment's config or of which hooks
+    // happen to be declared.
+    const requestedBy = actingPrincipalIdOf(ctx);
+    if (!requestedBy) {
+      throw new Error("rotate_webhook needs a verified sender — a triggered routine fire has no acting sender (only the creator it is attributed to), and there is nobody in a fire to hand a fresh signing secret to. Ask a person in this conversation to rotate it.");
+    }
+    // 🔴 ONE SURFACE GATE, NOT TWO (OPE-327). A `hasApprovalCardPath` refusal used to stand above
+    // this one. It was SUBSUMED: private delivery implies a card path on every platform, which
+    // webhook-provisioning-test.ts § PRIVATE DELIVERY predicate pins — that pin going red is the tripwire that reopens the
+    // question. So every surface the card check would have refused dies here anyway, and keeping
+    // both changed only the MESSAGE. That message was also FALSE: it named Discord as a working
+    // surface for this tool, while `hasPrivateDeliveryPath("discord")` is false.
+    //
+    // The same subsumption is why `rotate_webhook` is CARVED OUT of the OPE-325/326 card-venue
+    // sweep. Swapping the removed refusal for `checkApprovalVenue` would post the card in another
+    // room and then refuse one line later — a redirect leg that can never run. The sweep's licence
+    // is "only the CARD moves"; this tool's product is a DISCLOSURE ADDRESSED TO A PERSON, and a
+    // venue supplies rooms, not people. See review/design/rotate-webhook-cardless-plan.md.
+    //
+    // "You" in the refusal below is exact, and stays exact under the OPE-327 delivery ruling: the
+    // reveal goes to the ASKER (approvals/webhook.ts deliverReveal), and the asker is whoever is
+    // reading this refusal in their own turn.
+    if (!hasPrivateDeliveryPath(binding.platform) || !revealPageAvailable()) {
+      throw new Error(
+        `I can't hand over a new signing secret from "${binding.platform}" — it needs a surface where I can send you a private message, and a deployment configured to serve one-time links. Rotating without being able to give you the result would just break the webhook.`,
+      );
+    }
+
+    const p = resolvePartition(ctx);
+    // 🔴 THE ROOM THAT ASKED, NOT THE ROOM THAT ARRIVED LAST (OPE-1756). `p` above is the TURN's
+    // partition, and a turn that merged queued deliveries carries only the LAST delivery's auth —
+    // so on a turn answering two rooms it names the wrong one. The GOVERNED scope follows the
+    // ADDRESSED wake instead, through the same road the reply path uses; it falls back to `p` on
+    // every unknown, so a single-wake turn is unchanged.
+    // 🔴 THE MERGE ROAD IS UNREACHABLE ON eve 0.54.3; THIS READ IS STILL LIVE (OPE-2042). eve batches
+    // adjacent queued deliveries only when their full auth contexts match, and OE stamps a fresh
+    // per-delivery `oe_delivery_id` into `auth.attributes`, so two auth-carrying deliveries on one
+    // unified window never compare equal; only the caller-less task COMPLETION COHORT still folds,
+    // and it carries no `auth` at all. But the TURN's ctx names the wrong room WITHOUT any merge
+    // too: a turn woken by an INTERNAL wake — an approval decision, a completion — answers a
+    // conversation whose envelope is in the seat's shared context, through the reply fence's
+    // same-conversation and pending arms (`channels/unified-window.ts` `resolveAnswerableReplyTarget`,
+    // arms 3 and 4). Measured in production on 2026-08-15 (`docs/glossary.md`). So this read is
+    // LOAD-BEARING, not defensive. `scripts/coalesced-delivery-merge-assumption-test.ts` pins only
+    // the merge road's impossibility.
+    // 🔴 WHAT MOVES IS THE GOVERNANCE KEY ONLY. Anything else this tool derives from `p` — the memory
+    // tier, the card's venue walk, and any surface key frozen into the proposal's own `args` — keeps
+    // reading the TURN's partition, deliberately: those name what the act DOES and where this seat
+    // lives, while the scope key names who may approve it and which halt covers it. Moving the act's
+    // own target is a design choice this task does not hold.
+    const proposeScopeKey = await proposalScopeKey(ctx, p);
+    const id = input.source.trim().toLowerCase();
+    const declared = findWebhook(getConfig().loadWebhooks?.() ?? [], id);
+    if (!declared) {
+      throw new Error(`There's no "${id}" webhook declared here. Use list_webhooks to see what exists, or declare_webhook to propose a new one.`);
+    }
+    // FAIL CLOSED IN THE ROOM on the home, rather than posting a card whose click would refuse:
+    // `broker: "env"` means the value is set outside this deployment, and no click here can change
+    // that. The refusal names the variable AND the one-line config change that makes it rotatable.
+    if (declared.broker !== "db") {
+      const ref = typeof declared.secretRef === "string" ? declared.secretRef : declared.secretRef[0];
+      throw new Error(
+        `The "${declared.id}" webhook keeps its secret outside this deployment (broker "${declared.broker}"), so I can't issue one for it. ` +
+          `An operator sets ${declared.broker === "env" ? `the environment variable \`${ref}\`` : `ref \`${ref}\``} and redeploys. ` +
+          `If you'd rather issue it from here in future, its declaration needs changing to \`broker: "db"\` — that's a PR, and I can propose one.`,
+      );
+    }
+
+    const channelId = typeof binding.target?.channelId === "string" ? binding.target.channelId : undefined;
+    if (!channelId) throw new Error("rotate_webhook couldn't resolve this channel's id for the approval card — try again from a real channel.");
+
+    const posted = await requestApproval(
+      {
+        org: p.org,
+        kind: "webhook.rotate",
+        // The hook is named by its DECLARED id, and `execute` re-reads the registry at click time —
+        // a declaration cannot be re-pointed by anything short of a merged PR, so freezing a copy
+        // of it here would only create something to go stale.
+        args: {
+          org: p.org,
+          hookId: declared.id,
+          posture: configHookPosture(declared),
+          surfaceKey: p.surfaceKey,
+          requestedBy,
+          platform: binding.platform,
+          channelId,
+        },
+        scopeKey: proposeScopeKey,
+        domain: null,
+        requestedBy,
+        channelId,
+        threadTs: binding.threadTs ?? null,
+        postedTo: postedToSurfaceKey(binding, channelId),
+        chain: { unattended: unattendedOf(ctx) },
+      },
+      approvalPostDeps(binding.platform, ctx),
+    );
+
+    const subject = `issuing a fresh signing secret for the "${declared.id}" webhook`;
+    // ⚠️ `webhook.rotate` is a BENEFICIARY-CLICKER kind: its execute mints a live signing secret and destroys the one in use, and only a card click produces a `decidedBy` that is a person — a mint this destructive may not be lowered to a `chain:<element>` decision. The chain's beneficiary-clicker floor refuses to lower any such kind, so this branch is currently unreachable for this tool. (The reveal goes to the ASKER, not the decider, which is why the floor's reason is about WHO DECIDES rather than who receives — see access/approver-chain.ts's arrow.)
+    // It stays live because the approval return type is shared across every kind, and it relays the note verbatim rather than assuming unreachability: a chain change is one config diff away, and a fixed "you'll get a link" sentence would be false the moment it fires again.
+    if (posted.autoApproved) {
+      return {
+        rotated: true,
+        pending: false,
+        autoApproved: true,
+        pendingId: posted.id,
+        source: declared.id,
+        message: autoApprovedNote(subject, posted.autoApproved),
+      };
+    }
+    return {
+      rotated: false,
+      pending: true,
+      pendingId: posted.id,
+      source: declared.id,
+      message: `card posted — ${subject}, awaiting a human to approve it (pending ${posted.id}). On approval YOU get a private one-time link with it, because you asked — whoever approves sees only the decision. Nothing needs redeploying.` + proposerTail(posted),
+    };
+  },
+});

package/agent/tools/run_routine_now.ts

@@ -0,0 +1,120 @@
+// run_routine_now brings a scheduled run forward without changing the schedule. OPEN tier for a structural reason rather than a lenient one: it fires a routine A HUMAN ALREADY ARMED, with the prompt they read on its card, into the surface that already owns it — the same privilege, sooner — and every consequential thing the fired turn then tries re-gates on its own.
+// 🔴 It is NOT a second fire path: it sets `nextRunAt` to now and the ORDINARY dispatcher tick fires it, so the manual run inherits the spend gate, the trust recheck, the concurrency cap, the job anchor and the forensic join because it is LITERALLY the same code. A tool execute also holds no `receive`, so firing from here would mean a self-dispatch hop plus a hand-rolled copy of the gate ladder. The cost, stated plainly: "now" means within one dispatcher tick, and the tool says so rather than claiming it has run. Rate-limited per routine to one tick, which is the honest bound.
+
+import { defineTool } from "eve/tools";
+import { never } from "eve/tools/approval";
+import { z } from "zod";
+import { resolvePartition } from "../memory/partition.js";
+import { actingPrincipalIdOf } from "../access/request.js";
+import { getRoutine, updateRoutine } from "../routines/store.js";
+import { describeTrigger, isClockScheduled } from "../routines/routine.js";
+import { auditRoutineRunNow } from "../routines/fire-audit.js";
+import { DISPATCH_TICK_MINUTES } from "../routines/schedule.js";
+import { getOperationalStore } from "../operational/provider.js";
+
+/** Per-routine cooldown on manual runs — ONE dispatcher tick. See the header for why this is the
+ *  only defensible number: inside one tick a second request cannot produce a second run. */
+const RUN_NOW_WINDOW_MS = DISPATCH_TICK_MINUTES * 60_000;
+
+/** The rate-limit identity. Both parts are OE-minted (`r-xxxxxxxx` from routines/store.ts
+ *  newRoutineId, and a fixed prefix) — never a caller-supplied string, so no caller can mint fresh
+ *  keys to defeat the limit (routines/fire-audit.ts §"THE THROTTLE KEY MUST NOT CONTAIN AN
+ *  ATTACKER-CHOSEN STRING"). */
+function runNowThrottleKey(routineId: string): string {
+  return `routinerunnow:${routineId}`;
+}
+
+export default defineTool({
+  description:
+    "Run an existing routine ONCE right now, off its schedule, without changing the schedule. Get the id from list_routines. Use when someone wants to test a routine they just set up, or wants today's run early ('run the digest now'). It does NOT run instantly: it moves the routine to due, and the scheduler picks it up within a few minutes — say that in plain words rather than claiming it has run. The routine keeps its cadence, its history and its run state; the next scheduled run is unaffected. Rate-limited to one manual run per routine per few minutes.",
+  inputSchema: z.object({
+    id: z.string().min(1).describe("The routine id, e.g. 'r-1a2b3c4d' (from list_routines)."),
+  }),
+  outputSchema: z.object({
+    queued: z.boolean().describe("True when this call moved the routine to due. False = refused (see message)."),
+    id: z.string(),
+    trigger: z.string(),
+    dueAt: z.string().nullable().describe("When the routine is now due (ISO, UTC) — the scheduler fires it on its next tick at/after this."),
+    withinMinutes: z.number().describe("Worst-case wait before the run starts, in minutes (the dispatcher tick cadence)."),
+    message: z.string(),
+  }),
+  approval: never(),
+  async execute(input, ctx) {
+    const p = resolvePartition(ctx);
+    const id = input.id.trim();
+
+    // A verified human, always. This is the loop guard (see the header): a fired turn that reaches
+    // for this tool is refused here, so a routine cannot re-trigger itself or another routine.
+    //
+    // 🔴 IT ASKS FOR THE *ACTING* PRINCIPAL (OPE-269), and the distinction is the whole guard. This
+    // used to read `principalIdOf`, on the belief that "a routine fire carries no principal" — which
+    // was measurably FALSE: a fire binds eve's own schedule principal (`eve:app`,
+    // eve/channel/schedule-auth.js), a non-empty string, so the guard never fired and a fire could
+    // already reach this tool. Now a fire binds as its routine's ATTESTED creator, which would have
+    // made the same read not merely permissive but LAUNDERING — the loop recorded as a human's
+    // manual run. `actingPrincipalIdOf` is `undefined` on any fire, whoever it is attributable to.
+    // principal-gate: presence — the documented loop guard. A fire re-triggering a fire is a loop with no
+    // human in it, and the bound read would have recorded it as a person's manual run (OPE-269).
+    const requestedBy = actingPrincipalIdOf(ctx);
+    if (!requestedBy) {
+      throw new Error(
+        "run_routine_now needs a verified sender — an unattended routine fire has no acting sender (only the creator it is attributed to), and a routine may not re-trigger itself or another routine. Ask a person in this conversation to run it.",
+      );
+    }
+
+    const routine = await getRoutine(p.org, p.surfaceKey, id);
+    if (!routine) {
+      throw new Error(`No routine '${id}' on this surface — check the id with list_routines.`);
+    }
+    if (routine.status !== "active") {
+      throw new Error(
+        routine.status === "done"
+          ? `Routine '${id}' is a finished job (${routine.completedReason ?? "completed"}) — a completed job is terminal. Create a fresh routine if the work has come back.`
+          : `Routine '${id}' is disabled (${routine.disabledReason ?? "no reason recorded"}) — re-arm it with enable_routine first, then run it.`,
+      );
+    }
+    // Only CLOCK-scheduled routines have a "due" to bring forward. An `event` subscription is
+    // matched against inbound deliveries, so moving nextRunAt would change nothing at all — refuse
+    // rather than report a queued run that can never happen.
+    if (!isClockScheduled(routine.trigger)) {
+      throw new Error(
+        `Routine '${id}' is an event subscription (${describeTrigger(routine.trigger, routine.report)}) — it runs when a matching event arrives, so there's no scheduled run to bring forward.`,
+      );
+    }
+
+    // Host-side rate limit, an atomic CAS, so two concurrent turns cannot both win.
+    // FAIL-OPEN on a store error: the limiter and the write hit the SAME store, so a failure here means the update below is about to fail harmlessly anyway, and failing closed would turn a transient blip into a refusal a human cannot act on.
+    const now = new Date();
+    const nowIso = now.toISOString();
+    let first = true;
+    try {
+      first = await getOperationalStore().markEventSeen(p.org, runNowThrottleKey(id), nowIso, RUN_NOW_WINDOW_MS);
+    } catch {
+      first = true;
+    }
+    if (!first) {
+      return {
+        queued: false,
+        id,
+        trigger: describeTrigger(routine.trigger, routine.report),
+        dueAt: routine.nextRunAt ?? null,
+        withinMinutes: DISPATCH_TICK_MINUTES,
+        message: `routine ${id} already has a manual run queued (one per ${DISPATCH_TICK_MINUTES} minutes) — it will start on the next scheduler tick.`,
+      };
+    }
+
+    // Make it DUE, and stamp the request so the fire it causes can be audited as manual. The dispatcher clears that stamp in the same optimistic advance that stops a double-fire, so this is ONE extra run, never a mode.
+    // Everything else on the row — cadence, history, job state, the failure counter — is untouched by construction, because the update is a patch.
+    await updateRoutine(p.org, p.surfaceKey, id, { nextRunAt: nowIso, manualRunAt: nowIso });
+    await auditRoutineRunNow(routine, requestedBy, nowIso);
+
+    return {
+      queued: true,
+      id,
+      trigger: describeTrigger(routine.trigger, routine.report),
+      dueAt: nowIso,
+      withinMinutes: DISPATCH_TICK_MINUTES,
+      message: `routine ${id} is queued to run — the scheduler picks it up within ${DISPATCH_TICK_MINUTES} minutes. Its schedule (${describeTrigger(routine.trigger, routine.report)}) is unchanged.`,
+    };
+  },
+});

package/agent/tools/sandbox_tools.ts

@@ -0,0 +1,94 @@
+// The per-GRAIN provider of the six framework sandbox/egress tools. FOUR of the six — `bash`, `read_file`, `write_file`, `web_fetch` — are eve built-ins this app removes outright with `disableTool()` sentinels (roster.config.ts), because a dynamic tool can only SHADOW a static one when it resolves, so absence on a standing seat is only real once the static built-in is gone. `glob` and `grep` need no sentinel and carry none: eve mounts those two only on opt-in and this app never opts in, so there is no static built-in to remove. This ONE map-returning resolver then provides all six on the full-kit grains and none on a standing seat; map keys mount under their bare names, which a single-entry resolver could not do.
+// Each entry keeps the stall-guard wrap. The tier for all six stays `open`: the grain gate keys on the wide-hands class, never on the consequence tier.
+
+import { defineTool } from "eve/tools";
+// Each default is its own public subpath under the same symbol name, so six imports is the whole set.
+import { bash } from "eve/tools/bash";
+import { glob } from "eve/tools/glob";
+import { grep } from "eve/tools/grep";
+import { readFile } from "eve/tools/read_file";
+import { writeFile } from "eve/tools/write_file";
+import { webFetch } from "eve/tools/web_fetch";
+import { withStallGuard } from "../stall/guard.js";
+import { withBashHangGuard } from "../stall/bash-hang-guard.js";
+import { windowGatedKit } from "../access/window-gated.js";
+import { ingestUntrusted, ingestUntrustedModelOutput } from "../access/untrusted.js";
+import { withEgressFence } from "../access/web-fetch-fence.js";
+import { withMemoryWriteFence } from "../memory/write-fence.js";
+import { extractSkillEnvelopes, sanitizeSkillEnvelopeSource } from "../access/skill-taint-envelope.js";
+
+/** eve's WEB_FETCH_OUTPUT_SCHEMA shape (`eve/tools/web_fetch` WEB_FETCH_OUTPUT_SCHEMA) — strict, so these
+ *  fields are guaranteed present on a successful fetch. */
+interface WebFetchOutput {
+  content: string;
+  contentType: string;
+  truncated: boolean;
+  url: string;
+}
+
+/** eve's BASH_OUTPUT_SCHEMA shape (`eve/tools/bash` BASH_OUTPUT_SCHEMA) — a strict object, so these
+ *  four fields are present on every bash result. */
+interface BashOutput {
+  exitCode: number;
+  stderr: string;
+  stdout: string;
+  truncated: boolean;
+}
+
+/**
+ * Authoring this means owning ALL bash-result rendering, so the NO-ENVELOPE path — the overwhelmingly common one — must render BYTE-IDENTICALLY to eve's default. Returning `{ type: "json", value: output }` reproduces it by construction: eve wraps the return through the SAME normalizer, and a json part passes through unchanged.
+ * On the envelope path each declared span goes through the unconditionally-untrusted `skill-declared` row, which both fences it and marks the turn. Only `stdout` is transformed; exit code, stderr and truncation are preserved in place, so status still reaches the model.
+ */
+export function bashModelOutput(output: unknown): { type: "json"; value: unknown } {
+  const o = output as BashOutput;
+  const stdout = typeof o?.stdout === "string" ? o.stdout : "";
+  const segments = extractSkillEnvelopes(stdout);
+  if (!segments.some((s) => s.untrusted)) {
+    // BYTE-PARITY: identical to eve's default (no toModelOutput) rendering — the untouched output.
+    return { type: "json", value: output };
+  }
+  const rebuiltStdout = segments
+    .map((s) => {
+      if (!s.untrusted) return s.text;
+      const label = sanitizeSkillEnvelopeSource(s.source);
+      return ingestUntrusted(s.content, {
+        source: `skill-declared ${label}`,
+        // The label is the SANITIZED source name, never content — it lands in a `taint.verdict`
+        // audit row, which is names only. The kind is the unconditionally-untrusted row.
+        ingestion: { kind: "skill-declared", label },
+      });
+    })
+    .join("");
+  return { type: "json", value: { ...o, stdout: rebuiltStdout } };
+}
+
+export default windowGatedKit("sandbox_tools", {
+  // `bash` carries a second wrap the other five do not: the hang guard, which refuses a backgrounded-but-unredirected command up front and bounds every other call at a configurable cap. That cap is NOT calibrated against a known framework ceiling. Ordered INSIDE the stall guard, so an armed spin is short-circuited before any command inspection happens.
+  // It also carries a `toModelOutput`: a skill script running in the sandbox can DECLARE external bytes it fetched by wrapping them in the stdout taint envelope, and this projection is the host recognizer that fences and taints each declared span. It is ADD-taint-only, and byte-identical to eve's default on the no-envelope path.
+  bash: defineTool({
+    ...withStallGuard("bash", withBashHangGuard(bash)),
+    toModelOutput: bashModelOutput,
+  }),
+  glob: defineTool(withStallGuard("glob", glob)),
+  grep: defineTool(withStallGuard("grep", grep)),
+  read_file: defineTool(withStallGuard("read_file", readFile)),
+  // `write_file` carries the memory write fence. The sandbox's memory tree holds one directory per MATERIALISED silo and its root is an ordinary writable directory, so a write naming a silo the session never materialised created that directory, reported no error, and was then dropped at flush time.
+  // The fence refuses that write and names the silos this session can actually persist. Ordered INSIDE the stall guard, for the same reason the other wraps are.
+  write_file: defineTool(withStallGuard("write_file", withMemoryWriteFence("write_file", writeFile))),
+  // `web_fetch` is the one sandbox tool whose result is EXTERNAL content rather than the agent's own working files, so unlike its five siblings it projects through the untrusted funnel — fence, cap, taint and loop-breaker.
+  // It is also the only one of the six that reaches the NETWORK, and it does so HOST-SIDE where the sandbox firewall cannot see it, so the egress fence puts its destination through the same allow-list decision every other host-side fetch passes. The tier stays `open`: the fence governs REACH, and a read that escapes nothing is still a read.
+  web_fetch: defineTool({
+    ...withStallGuard("web_fetch", withEgressFence("web_fetch", webFetch)),
+    // `unknown` param (cast inside): eve's ToolDefinition types execute as returning
+    // unknown, so a WebFetchOutput-typed param would force an Out the execute can't satisfy.
+    toModelOutput(output: unknown) {
+      const o = output as WebFetchOutput;
+      return ingestUntrustedModelOutput(o.content, {
+        source: `web_fetch ${o.url}${o.truncated ? " (truncated)" : ""}`,
+        // DECLARE the source. An undeclared ingestion site keeps its own unconditional taint, which happens to be the same answer the tier table gives — but by accident rather than by the table.
+        // The label is the TOOL NAME, never the URL: `source` above may carry an attacker-chosen URL, and this field lands in an audit row, which is names only.
+        ingestion: { kind: "web", label: "web_fetch" },
+      });
+    },
+  }),
+});

package/agent/tools/search.ts

@@ -0,0 +1,121 @@
+// search is THE federating cross-container work search: ONE verb rather than per-vendor variants, with the vendor work tools reached through its own registry and never duplicated here. It MOUNTS behind the work grant and only the work grant — chat presence is never a precondition — and federates over every connector this domain holds a work grant on that has a registered search adapter, where a granted connector with no adapter is a NAMED absence rather than a silent skip.
+// 🔴 `insideDomain` is a CONVENIENCE, never a security boundary: each adapter's unscoped reach is already exactly the credential's own reach, and nothing here or in any adapter filters that as enforcement — the flag only narrows a query that was already going to succeed. It MUST NOT return bodies: every hit is an id and a title, a pointer rather than an answer, so reading what a hit points at takes a second, FENCED step.
+
+import { defineDynamic, defineTool } from "eve/tools";
+import { z } from "zod";
+import type { BindableContext } from "../identity/binding.js";
+import { getConfig } from "../access/config.js";
+import { preRegisterDynamicEntry } from "../access/window-gated.js";
+import { ingestUntrustedModelOutput } from "../access/untrusted.js";
+import { searchGrantedConnectors, workSearchAdapterFor, type WorkSearchAbsence, type WorkSearchHit } from "../channels/work-search.js";
+import { callerWorkDomain } from "../access/work-grant.js";
+import type { Domain } from "../memory/domain.js";
+// Module-load registration for GitHub's core-resident search adapter (ungated — see
+// scm/github-search.ts's own header for why it does not go through provider selection).
+import { registerGithubWorkSearch } from "../scm/github-search.js";
+
+registerGithubWorkSearch();
+
+const MAX_RESULTS = 25;
+const DEFAULT_LIMIT = 10;
+
+function safeDomains(): readonly Domain[] {
+  try {
+    return getConfig().loadDomains();
+  } catch {
+    return [];
+  }
+}
+
+// Exported for the unit test (calls .execute directly, mirroring notion_search.ts's pattern).
+export const searchEntry = defineTool({
+  description:
+    "Search this domain's connected work surfaces (GitHub, Notion, Linear, ...) by keyword, and get " +
+    "back ids + titles — a pointer, not an answer. A result names its connector; read the actual " +
+    "item with the matching read tool (read_notion_page, read_linear_issue, check_pr_status, ...). " +
+    "Omit `scope` to search every surface this domain holds a work grant on; a surface with no " +
+    "search-capable credential is reported absent, not silently skipped.",
+  inputSchema: z.object({
+    query: z.string().min(1).describe("Words to search for."),
+    scope: z.string().min(1).optional().describe('Restrict the search to one connected surface, e.g. "github". Omit to search every granted surface.'),
+    insideDomain: z
+      .boolean()
+      .optional()
+      .describe(
+        "Narrow each surface's results to this domain's own declared space (its bound repos/pages/teams) — a CONVENIENCE, not a security boundary: every result is already bounded by the credential's own reach whether or not this is set.",
+      ),
+    limit: z.number().int().min(1).max(MAX_RESULTS).optional().describe(`How many results per surface (default ${DEFAULT_LIMIT}, max ${MAX_RESULTS}).`),
+  }),
+  outputSchema: z.object({
+    query: z.string(),
+    insideDomain: z.boolean(),
+    hits: z.array(z.object({ connector: z.string(), id: z.string(), title: z.string(), url: z.string().optional() })),
+    absent: z.array(z.object({ connector: z.string(), reason: z.string() })),
+  }),
+  // NO `approval:` — read-only, mirrors notion_search.ts's own dynamic-tool replay note.
+  async execute(input, ctx) {
+    const bctx = ctx as BindableContext;
+    const domains = safeDomains();
+    // Re-checked in EXECUTE rather than trusted from the mount: a session resolves its tools once at session start, and a revoked grant should stop working on the very next call rather than on the next session restart.
+    // 🔴 `domain` may be undefined even when `granted` is not — GitHub's grant is the access bundle's repo list, which an org-level binding hands out with no memory-domain match at all. So the refusal below reads `granted`, never `domain`.
+    const domain = callerWorkDomain(bctx, () => domains);
+    const granted = searchGrantedConnectors(bctx, domains);
+    if (granted.length === 0) {
+      throw new Error("This domain holds no work grant on any connected surface, so search is unavailable here.");
+    }
+    const scope = input.scope?.trim();
+    if (scope && !granted.includes(scope)) {
+      throw new Error(`This domain holds no "${scope}" work grant. Grants held: ${granted.join(", ")}.`);
+    }
+    const targets = scope ? [scope] : granted;
+    const insideDomain = input.insideDomain ?? false;
+    const limit = input.limit ?? DEFAULT_LIMIT;
+
+    const hits: WorkSearchHit[] = [];
+    const absent: WorkSearchAbsence[] = [];
+    for (const connector of targets) {
+      const adapter = workSearchAdapterFor(connector);
+      if (!adapter) {
+        absent.push({ connector, reason: `no search-capable credential configured for ${connector}` });
+        continue;
+      }
+      try {
+        const connectorHits = await adapter.search(bctx, domain, input.query, { limit, insideDomain });
+        hits.push(...connectorHits);
+      } catch (err) {
+        absent.push({ connector, reason: err instanceof Error ? err.message : String(err) });
+      }
+    }
+
+    return { query: input.query, insideDomain, hits: hits.slice(0, MAX_RESULTS), absent };
+  },
+  toModelOutput(output) {
+    const lines: string[] = [];
+    if (output.hits.length === 0) {
+      lines.push(`Search for "${output.query}" matched nothing across the surfaces this domain can reach.`);
+    } else {
+      lines.push(`Search for "${output.query}" — ${output.hits.length} result(s):`);
+      for (const h of output.hits) lines.push(`- [${h.connector}] ${h.id}: ${h.title}${h.url ? ` (${h.url})` : ""}`);
+    }
+    if (output.absent.length > 0) {
+      lines.push(`Not searched: ${output.absent.map((a) => `${a.connector} (${a.reason})`).join("; ")}.`);
+    }
+    return ingestUntrustedModelOutput(lines.join("\n"), {
+      source: "search",
+      ingestion: { kind: "work-search", label: "search" },
+    });
+  },
+});
+preRegisterDynamicEntry("search", "_single", searchEntry);
+
+export default defineDynamic({
+  events: {
+    "session.started": (_event, ctx) => {
+      const bctx = ctx as BindableContext;
+      // Mount on the RAW grant set, not the ticket-registry-filtered destinations.
+      // That filtered set is the wrong predicate here: it would exclude a connector with no ticket-create adapter that is nonetheless a perfectly good search connector.
+      if (searchGrantedConnectors(bctx, safeDomains()).length === 0) return null;
+      return searchEntry;
+    },
+  },
+});